Brazilian banking malware Astaroth has evolved with a dangerous new capability that exploits WhatsApp Web to spread itself across victim networks automatically.
Security researchers at Acronis have uncovered a sophisticated campaign that retrieves victims’ WhatsApp contact lists and sends malicious messages to every contact, creating a self-perpetuating infection loop targeting Windows systems.
The malware represents a significant evolution from its previous iterations. While the core Astaroth payload remains written in Delphi with a Visual Basic script installer, the newly added WhatsApp-based worm module is implemented entirely in Python.
This multilanguage approach demonstrates the threat actors’ increasingly sophisticated technical capabilities and modular development strategy.
The campaign, internally designated Boto Cor-de-Rosa by Acronis researchers, notes Astaroth’s established pattern of targeting Brazilian victims almost exclusively.
The attackers leverage region-specific lures, local ecosystem knowledge, and culturally familiar communication channels to maximize infection success rates.
Sophisticated Infection Mechanism
The infection begins when victims receive a WhatsApp message containing a malicious ZIP archive with names following a specific pattern of digits and hexadecimal characters, such as “552_516107-a9af16a8-552.zip.”
Upon extraction, victims encounter a Visual Basic script disguised as a benign file that triggers the download of next-stage components.
Once the payloads are delivered, the malware operates through two parallel modules. The propagation module harvests the victim’s WhatsApp contacts.
It automatically sends each one a new malicious ZIP file, sustaining continuous spread. Meanwhile, the banking module silently monitors browsing activity, activating credential-stealing functionality when banking-related URLs are accessed.
What distinguishes this campaign is its remarkable attention to social engineering detail. The malware crafts messages in Portuguese that read: “Here is the requested file.
If you have any questions, I’m available!” This casual, familiar phrasing mirrors everyday WhatsApp interactions, increasing the likelihood that recipients will trust and open the attachment without suspicion.
A closer look at zapbiu.py source code reveals the exact message template used by the malware to initiate the fraudulent conversation.
The spreader script demonstrates sophisticated programming, automatically initiating conversations with context-appropriate greetings based on the time of day “Bom dia” (good morning), “Boa tarde” (good afternoon), or “Boa noite” (good evening). This temporal awareness makes the messages appear more authentic and legitimate.
Technical Implementation
The VBS downloader, typically 50 to 100 KB and heavily obfuscated, retrieves both the core Astaroth banking payload and the Python-based WhatsApp spreader.
The downloaded MSI package deploys files into the C:\Public\MicrosoftEdgeCache_6.60.2.9313 directory, following Astaroth’s known deployment pattern of bundling a legitimate AutoIt interpreter alongside an encoded loader.
The propagation component includes built-in mechanisms to track and report metrics in real time. After every 50 messages, the script calculates the percentage of contacts processed and current throughput, printing progress updates.
Additionally, the malware exfiltrates the victim’s complete contact list to a remote server for further exploitation.
This campaign underscores the dangerous convergence of traditional credential-stealing techniques with sophisticated social engineering and messaging-based propagation.
By exploiting WhatsApp as a distribution channel, the malware accelerates its spread while leveraging trust-based communication patterns inherent in messaging platforms.
Organizations must deploy layered defenses monitoring both traditional attack vectors and emerging social-engineering techniques.
The integration of messaging-based propagation with financial credential theft represents a concerning trend in malware evolution, illustrating how attackers blend technical innovation with psychological manipulation to maximize impact.
User vigilance remains critical, particularly when receiving unsolicited files through messaging platforms, even from known contacts.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
